diff --git a/Cargo.lock b/Cargo.lock
index 168c6bc2b4533..b8de1b9fe481d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -270,7 +270,7 @@ dependencies = [
  "arrow-schema",
  "chrono",
  "half 2.6.0",
- "hashbrown 0.15.3",
+ "hashbrown 0.15.4",
  "num",
 ]
 
@@ -905,7 +905,7 @@ dependencies = [
  "hex",
  "hmac",
  "http 0.2.9",
- "http 1.2.0",
+ "http 1.3.1",
  "percent-encoding",
  "sha2",
  "time",
@@ -988,7 +988,7 @@ dependencies = [
  "bytes-utils",
  "futures-core",
  "http 0.2.9",
- "http 1.2.0",
+ "http 1.3.1",
  "http-body 0.4.5",
  "percent-encoding",
  "pin-project-lite",
@@ -1058,7 +1058,7 @@ dependencies = [
  "bytes",
  "fastrand 2.3.0",
  "http 0.2.9",
- "http 1.2.0",
+ "http 1.3.1",
  "http-body 0.4.5",
  "http-body 1.0.1",
  "pin-project-lite",
@@ -1077,7 +1077,7 @@ dependencies = [
  "aws-smithy-types",
  "bytes",
  "http 0.2.9",
- "http 1.2.0",
+ "http 1.3.1",
  "pin-project-lite",
  "tokio",
  "tracing",
@@ -1095,7 +1095,7 @@ dependencies = [
  "bytes-utils",
  "futures-core",
  "http 0.2.9",
- "http 1.2.0",
+ "http 1.3.1",
  "http-body 0.4.5",
  "http-body 1.0.1",
  "http-body-util",
@@ -1140,30 +1140,56 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "edca88bc138befd0323b20752846e6587272d3b03b0343c8ea28a6f819e6e71f"
 dependencies = [
  "async-trait",
- "axum-core",
+ "axum-core 0.4.5",
+ "bytes",
+ "futures-util",
+ "http 1.3.1",
+ "http-body 1.0.1",
+ "http-body-util",
+ "itoa",
+ "matchit 0.7.0",
+ "memchr",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "rustversion",
+ "serde",
+ "sync_wrapper 1.0.2",
+ "tower 0.5.2",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "axum"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a18ed336352031311f4e0b4dd2ff392d4fbb370777c9d18d7fc9d7359f73871"
+dependencies = [
+ "axum-core 0.5.5",
  "base64 0.22.1",
  "bytes",
+ "form_urlencoded",
  "futures-util",
- "http 1.2.0",
+ "http 1.3.1",
  "http-body 1.0.1",
  "http-body-util",
  "hyper 1.6.0",
  "hyper-util",
  "itoa",
- "matchit",
+ "matchit 0.8.4",
  "memchr",
  "mime",
  "percent-encoding",
  "pin-project-lite",
- "rustversion",
- "serde",
+ "serde_core",
  "serde_json",
  "serde_path_to_error",
  "serde_urlencoded",
  "sha1",
  "sync_wrapper 1.0.2",
  "tokio",
- "tokio-tungstenite 0.24.0",
+ "tokio-tungstenite 0.28.0",
  "tower 0.5.2",
  "tower-layer",
  "tower-service",
@@ -1179,7 +1205,7 @@ dependencies = [
  "async-trait",
  "bytes",
  "futures-util",
- "http 1.2.0",
+ "http 1.3.1",
  "http-body 1.0.1",
  "http-body-util",
  "mime",
@@ -1188,31 +1214,48 @@ dependencies = [
  "sync_wrapper 1.0.2",
  "tower-layer",
  "tower-service",
+]
+
+[[package]]
+name = "axum-core"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59446ce19cd142f8833f856eb31f3eb097812d1479ab224f54d72428ca21ea22"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http 1.3.1",
+ "http-body 1.0.1",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "sync_wrapper 1.0.2",
+ "tower-layer",
+ "tower-service",
  "tracing",
 ]
 
 [[package]]
 name = "axum-extra"
-version = "0.9.6"
+version = "0.10.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c794b30c904f0a1c2fb7740f7df7f7972dfaa14ef6f57cb6178dc63e5dca2f04"
+checksum = "9963ff19f40c6102c76756ef0a46004c0d58957d87259fc9208ff8441c12ab96"
 dependencies = [
- "axum",
- "axum-core",
+ "axum 0.8.6",
+ "axum-core 0.5.5",
  "bytes",
- "fastrand 2.3.0",
  "futures-util",
  "headers",
- "http 1.2.0",
+ "http 1.3.1",
  "http-body 1.0.1",
  "http-body-util",
  "mime",
- "multer",
  "pin-project-lite",
- "serde",
- "tower 0.5.2",
+ "rustversion",
+ "serde_core",
  "tower-layer",
  "tower-service",
+ "tracing",
 ]
 
 [[package]]
@@ -1436,7 +1479,7 @@ dependencies = [
  "bitflags 2.9.4",
  "cexpr",
  "clang-sys",
- "itertools 0.10.5",
+ "itertools 0.13.0",
  "proc-macro2",
  "quote",
  "regex",
@@ -2564,9 +2607,9 @@ dependencies = [
 
 [[package]]
 name = "data-encoding"
-version = "2.3.2"
+version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ee2393c4a91429dffb4bedf19f4d6abf27d8a732c8ce4980305d782e5426d57"
+checksum = "2a2330da5de22e8a3cb63252ce2abb30116bf5265e89c0e01bc17015ce30a476"
 
 [[package]]
 name = "datadriven"
@@ -3649,7 +3692,7 @@ dependencies = [
  "futures-timer",
  "futures-util",
  "getrandom 0.3.3",
- "hashbrown 0.15.3",
+ "hashbrown 0.15.4",
  "nonzero_ext",
  "parking_lot",
  "portable-atomic",
@@ -3734,7 +3777,7 @@ dependencies = [
  "fnv",
  "futures-core",
  "futures-sink",
- "http 1.2.0",
+ "http 1.3.1",
  "indexmap 2.11.4",
  "slab",
  "tokio",
@@ -3779,9 +3822,9 @@ dependencies = [
 
 [[package]]
 name = "hashbrown"
-version = "0.15.3"
+version = "0.15.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "84b26c544d002229e640969970a2e74021aadf6e2f96372b9c58eff97de08eb3"
+checksum = "5971ac85611da7067dbfcabef3c70ebb5606018acd9e2a3903a0da507521e0d5"
 dependencies = [
  "allocator-api2",
  "equivalent",
@@ -3810,7 +3853,7 @@ dependencies = [
  "base64 0.22.1",
  "bytes",
  "headers-core",
- "http 1.2.0",
+ "http 1.3.1",
  "httpdate",
  "mime",
  "sha1",
@@ -3822,7 +3865,7 @@ version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "54b4a22553d4242c49fddb9ba998a99962b5cc6f22cb5a3482bec22522403ce4"
 dependencies = [
- "http 1.2.0",
+ "http 1.3.1",
 ]
 
 [[package]]
@@ -3900,9 +3943,9 @@ dependencies = [
 
 [[package]]
 name = "http"
-version = "1.2.0"
+version = "1.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f16ca2af56261c99fba8bac40a10251ce8188205a4c448fbb745a2e4daa76fea"
+checksum = "f4a85d31aea989eead29a3aaf9e1115a180df8282431156e533de47660892565"
 dependencies = [
  "bytes",
  "fnv",
@@ -3927,7 +3970,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
 dependencies = [
  "bytes",
- "http 1.2.0",
+ "http 1.3.1",
 ]
 
 [[package]]
@@ -3938,7 +3981,7 @@ checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
 dependencies = [
  "bytes",
  "futures-core",
- "http 1.2.0",
+ "http 1.3.1",
  "http-body 1.0.1",
  "pin-project-lite",
 ]
@@ -3971,9 +4014,9 @@ checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
 
 [[package]]
 name = "httpdate"
-version = "1.0.2"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4a1e36c821dbe04574f602848a19f742f4fb3c98d40449f11bcad18d6b17421"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
 [[package]]
 name = "humantime"
@@ -4015,7 +4058,7 @@ dependencies = [
  "futures-channel",
  "futures-util",
  "h2 0.4.12",
- "http 1.2.0",
+ "http 1.3.1",
  "http-body 1.0.1",
  "httparse",
  "httpdate",
@@ -4032,7 +4075,7 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "527d4d619ca2c2aafa31ec139a3d1d60bf557bf7578a1f20f743637eccd9ca19"
 dependencies = [
- "http 1.2.0",
+ "http 1.3.1",
  "hyper 1.6.0",
  "hyper-util",
  "linked_hash_set",
@@ -4052,7 +4095,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2d191583f3da1305256f22463b9bb0471acad48a4e534a5218b9963e9c1f59b2"
 dependencies = [
  "futures-util",
- "http 1.2.0",
+ "http 1.3.1",
  "hyper 1.6.0",
  "hyper-util",
  "rustls",
@@ -4127,7 +4170,7 @@ dependencies = [
  "futures-channel",
  "futures-core",
  "futures-util",
- "http 1.2.0",
+ "http 1.3.1",
  "http-body 1.0.1",
  "hyper 1.6.0",
  "ipnet",
@@ -4221,7 +4264,7 @@ dependencies = [
  "aws-sigv4",
  "aws-types",
  "chrono",
- "http 1.2.0",
+ "http 1.3.1",
  "iceberg",
  "itertools 0.13.0",
  "reqwest 0.12.23",
@@ -4328,7 +4371,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4b0f83760fb341a774ed326568e19f5a863af4a952def8c39f9ab92fd95b88e5"
 dependencies = [
  "equivalent",
- "hashbrown 0.15.3",
+ "hashbrown 0.15.4",
  "serde",
  "serde_core",
 ]
@@ -4635,7 +4678,7 @@ dependencies = [
  "either",
  "futures",
  "home",
- "http 1.2.0",
+ "http 1.3.1",
  "http-body 1.0.1",
  "http-body-util",
  "hyper 1.6.0",
@@ -4669,7 +4712,7 @@ dependencies = [
  "chrono",
  "derive_more",
  "form_urlencoded",
- "http 1.2.0",
+ "http 1.3.1",
  "json-patch",
  "k8s-openapi",
  "schemars",
@@ -4705,7 +4748,7 @@ dependencies = [
  "backon",
  "educe",
  "futures",
- "hashbrown 0.15.3",
+ "hashbrown 0.15.4",
  "hostname",
  "json-patch",
  "k8s-openapi",
@@ -5026,7 +5069,7 @@ version = "0.12.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "234cf4f4a04dc1f57e24b96cc0cd600cf2af460d4161ac5ecdd0af8e1f3b2a38"
 dependencies = [
- "hashbrown 0.15.3",
+ "hashbrown 0.15.4",
 ]
 
 [[package]]
@@ -5035,7 +5078,7 @@ version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9f8cc7106155f10bdf99a6f379688f543ad6596a415375b36a59a054ceda1198"
 dependencies = [
- "hashbrown 0.15.3",
+ "hashbrown 0.15.4",
 ]
 
 [[package]]
@@ -5104,6 +5147,12 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b87248edafb776e59e6ee64a79086f65890d3510f2c656c000bf2a7e8a0aea40"
 
+[[package]]
+name = "matchit"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
+
 [[package]]
 name = "md-5"
 version = "0.10.6"
@@ -5202,23 +5251,6 @@ dependencies = [
  "uuid",
 ]
 
-[[package]]
-name = "multer"
-version = "3.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83e87776546dc87511aa5ee218730c92b666d7264ab6ed41f9d215af9cd5224b"
-dependencies = [
- "bytes",
- "encoding_rs",
- "futures-util",
- "http 1.2.0",
- "httparse",
- "memchr",
- "mime",
- "spin 0.9.8",
- "version_check",
-]
-
 [[package]]
 name = "multimap"
 version = "0.8.3"
@@ -5302,7 +5334,7 @@ name = "mz"
 version = "0.3.0"
 dependencies = [
  "assert_cmd",
- "axum",
+ "axum 0.8.6",
  "clap",
  "csv",
  "dirs",
@@ -5357,7 +5389,7 @@ dependencies = [
  "futures",
  "governor",
  "hex",
- "http 1.2.0",
+ "http 1.3.1",
  "hyper-tls 0.5.0",
  "ipnet",
  "itertools 0.14.0",
@@ -5580,7 +5612,7 @@ dependencies = [
  "bytes",
  "bytesize",
  "futures",
- "http 1.2.0",
+ "http 1.3.1",
  "hyper-tls 0.5.0",
  "mz-ore",
  "pin-project",
@@ -5596,7 +5628,7 @@ version = "0.161.0-dev.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum",
+ "axum 0.8.6",
  "bytes",
  "bytesize",
  "chrono",
@@ -5899,7 +5931,7 @@ name = "mz-clusterd"
 version = "0.161.0-dev.0"
 dependencies = [
  "anyhow",
- "axum",
+ "axum 0.8.6",
  "clap",
  "fail",
  "futures",
@@ -6203,7 +6235,7 @@ dependencies = [
  "askama",
  "assert_cmd",
  "async-trait",
- "axum",
+ "axum 0.8.6",
  "axum-extra",
  "base64 0.22.1",
  "bytes",
@@ -6218,7 +6250,7 @@ dependencies = [
  "flate2",
  "futures",
  "headers",
- "http 1.2.0",
+ "http 1.3.1",
  "http-body-util",
  "humantime",
  "hyper 1.6.0",
@@ -6319,7 +6351,7 @@ dependencies = [
  "tracing-capture",
  "tracing-opentelemetry",
  "tracing-subscriber",
- "tungstenite 0.24.0",
+ "tungstenite 0.28.0",
  "url",
  "uuid",
  "workspace-hack",
@@ -6486,7 +6518,7 @@ name = "mz-frontegg-auth"
 version = "0.0.0"
 dependencies = [
  "anyhow",
- "axum",
+ "axum 0.8.6",
  "base64 0.22.1",
  "clap",
  "derivative",
@@ -6530,7 +6562,7 @@ name = "mz-frontegg-mock"
 version = "0.0.0"
 dependencies = [
  "anyhow",
- "axum",
+ "axum 0.8.6",
  "axum-extra",
  "base64 0.22.1",
  "chrono",
@@ -6556,10 +6588,10 @@ version = "0.0.0"
 dependencies = [
  "anyhow",
  "askama",
- "axum",
+ "axum 0.8.6",
  "axum-extra",
  "headers",
- "http 1.2.0",
+ "http 1.3.1",
  "hyper 1.6.0",
  "include_dir",
  "mz-ore",
@@ -6885,7 +6917,7 @@ dependencies = [
  "clap",
  "derivative",
  "futures-core",
- "http 1.2.0",
+ "http 1.3.1",
  "humantime",
  "mz-build-info",
  "mz-orchestrator",
@@ -6908,11 +6940,11 @@ version = "0.161.0-dev.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum",
+ "axum 0.8.6",
  "chrono",
  "clap",
  "futures",
- "http 1.2.0",
+ "http 1.3.1",
  "k8s-controller",
  "k8s-openapi",
  "kube",
@@ -6966,7 +6998,7 @@ dependencies = [
  "either",
  "futures",
  "hibitset",
- "http 1.2.0",
+ "http 1.3.1",
  "hyper-tls 0.6.0",
  "hyper-util",
  "itertools 0.14.0",
@@ -7377,12 +7409,12 @@ version = "0.0.0"
 dependencies = [
  "anyhow",
  "askama",
- "axum",
+ "axum 0.8.6",
  "axum-extra",
  "bytesize",
  "cfg-if",
  "headers",
- "http 1.2.0",
+ "http 1.3.1",
  "include_dir",
  "jemalloc_pprof",
  "mappings",
@@ -7407,7 +7439,7 @@ dependencies = [
  "chrono",
  "chrono-tz",
  "globset",
- "http 1.2.0",
+ "http 1.3.1",
  "mz-build-tools",
  "mz-ore",
  "num",
@@ -7661,7 +7693,7 @@ dependencies = [
  "fail",
  "globset",
  "hex",
- "http 1.2.0",
+ "http 1.3.1",
  "iceberg",
  "im",
  "ipnet",
@@ -7904,7 +7936,7 @@ dependencies = [
  "anyhow",
  "async-stream",
  "async-trait",
- "axum",
+ "axum 0.8.6",
  "bincode",
  "bytes",
  "bytesize",
@@ -8072,7 +8104,7 @@ dependencies = [
  "differential-dataflow",
  "futures",
  "glob",
- "http 1.2.0",
+ "http 1.3.1",
  "itertools 0.14.0",
  "mz-arrow-util",
  "mz-aws-util",
@@ -8126,7 +8158,7 @@ dependencies = [
  "derivative",
  "differential-dataflow",
  "hex",
- "http 1.2.0",
+ "http 1.3.1",
  "iceberg",
  "iceberg-catalog-rest",
  "insta",
@@ -8216,7 +8248,7 @@ dependencies = [
  "futures",
  "globset",
  "hex",
- "http 1.2.0",
+ "http 1.3.1",
  "humantime",
  "itertools 0.14.0",
  "junit-report",
@@ -8764,7 +8796,7 @@ dependencies = [
  "crc32c",
  "futures",
  "getrandom 0.2.16",
- "http 1.2.0",
+ "http 1.3.1",
  "http-body 1.0.1",
  "log",
  "md-5",
@@ -8897,7 +8929,7 @@ checksum = "6b925a602ffb916fb7421276b86756027b37ee708f9dce2dbdcc51739f07e727"
 dependencies = [
  "async-trait",
  "futures-core",
- "http 1.2.0",
+ "http 1.3.1",
  "opentelemetry",
  "opentelemetry-proto",
  "opentelemetry_sdk",
@@ -9111,7 +9143,7 @@ dependencies = [
  "flate2",
  "futures",
  "half 2.6.0",
- "hashbrown 0.15.3",
+ "hashbrown 0.15.4",
  "lz4_flex",
  "num",
  "num-bigint",
@@ -9181,7 +9213,7 @@ dependencies = [
  "anyhow",
  "arrow",
  "async-trait",
- "axum",
+ "axum 0.8.6",
  "bytes",
  "clap",
  "differential-dataflow",
@@ -9272,7 +9304,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8701b58ea97060d5e5b155d383a69952a60943f0e6dfe30b04c287beb0b27455"
 dependencies = [
  "fixedbitset",
- "hashbrown 0.15.3",
+ "hashbrown 0.15.4",
  "indexmap 2.11.4",
 ]
 
@@ -10386,7 +10418,7 @@ dependencies = [
  "hex",
  "hmac",
  "home",
- "http 1.2.0",
+ "http 1.3.1",
  "log",
  "percent-encoding",
  "quick-xml 0.37.5",
@@ -10458,7 +10490,7 @@ dependencies = [
  "futures-core",
  "futures-util",
  "h2 0.4.12",
- "http 1.2.0",
+ "http 1.3.1",
  "http-body 1.0.1",
  "http-body-util",
  "hyper 1.6.0",
@@ -11478,12 +11510,6 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d"
 
-[[package]]
-name = "spin"
-version = "0.9.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
-
 [[package]]
 name = "spin"
 version = "0.10.0"
@@ -12306,26 +12332,26 @@ dependencies = [
 
 [[package]]
 name = "tokio-tungstenite"
-version = "0.24.0"
+version = "0.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edc5f74e248dc973e0dbb7b74c7e0d6fcc301c694ff50049504004ef4d0cdcd9"
+checksum = "489a59b6730eda1b0171fcfda8b121f4bee2b35cba8645ca35c5f7ba3eb736c1"
 dependencies = [
  "futures-util",
  "log",
  "tokio",
- "tungstenite 0.24.0",
+ "tungstenite 0.27.0",
 ]
 
 [[package]]
 name = "tokio-tungstenite"
-version = "0.27.0"
+version = "0.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "489a59b6730eda1b0171fcfda8b121f4bee2b35cba8645ca35c5f7ba3eb736c1"
+checksum = "d25a406cddcc431a75d3d9afc6a7c0f7428d4891dd973e4d54c56b46127bf857"
 dependencies = [
  "futures-util",
  "log",
  "tokio",
- "tungstenite 0.27.0",
+ "tungstenite 0.28.0",
 ]
 
 [[package]]
@@ -12442,12 +12468,12 @@ checksum = "877c5b330756d856ffcc4553ab34a5684481ade925ecc54bcd1bf02b1d0d4d52"
 dependencies = [
  "async-stream",
  "async-trait",
- "axum",
+ "axum 0.7.9",
  "base64 0.22.1",
  "bytes",
  "flate2",
  "h2 0.4.12",
- "http 1.2.0",
+ "http 1.3.1",
  "http-body 1.0.1",
  "http-body-util",
  "hyper 1.6.0",
@@ -12525,10 +12551,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4fd0118512cf0b3768f7fcccf0bef1ae41d68f2b45edc1e77432b36c97c56c6d"
 dependencies = [
  "async-trait",
- "axum-core",
+ "axum-core 0.4.5",
  "cookie",
  "futures-util",
- "http 1.2.0",
+ "http 1.3.1",
  "parking_lot",
  "pin-project-lite",
  "tower-layer",
@@ -12547,7 +12573,7 @@ dependencies = [
  "bytes",
  "futures-core",
  "futures-util",
- "http 1.2.0",
+ "http 1.3.1",
  "http-body 1.0.1",
  "http-body-util",
  "iri-string",
@@ -12614,7 +12640,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "65856c81ee244e0f8a55ab0f7b769b72fbde387c235f0a73cd97c579818d05eb"
 dependencies = [
  "async-trait",
- "http 1.2.0",
+ "http 1.3.1",
  "time",
  "tokio",
  "tower-cookies",
@@ -12632,10 +12658,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fb6abbfcaf6436ec5a772cd9f965401da12db793e404ae6134eac066fa5a04f3"
 dependencies = [
  "async-trait",
- "axum-core",
+ "axum-core 0.4.5",
  "base64 0.22.1",
  "futures",
- "http 1.2.0",
+ "http 1.3.1",
  "parking_lot",
  "rand 0.8.5",
  "serde",
@@ -12787,31 +12813,30 @@ checksum = "e604eb7b43c06650e854be16a2a03155743d3752dd1c943f6829e26b7a36e382"
 
 [[package]]
 name = "tungstenite"
-version = "0.24.0"
+version = "0.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18e5b8366ee7a95b16d32197d0b2604b43a0be89dc5fac9f8e96ccafbaedda8a"
+checksum = "eadc29d668c91fcc564941132e17b28a7ceb2f3ebf0b9dae3e03fd7a6748eb0d"
 dependencies = [
- "byteorder",
  "bytes",
  "data-encoding",
- "http 1.2.0",
+ "http 1.3.1",
  "httparse",
  "log",
- "rand 0.8.5",
+ "rand 0.9.2",
  "sha1",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
  "utf-8",
 ]
 
 [[package]]
 name = "tungstenite"
-version = "0.27.0"
+version = "0.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eadc29d668c91fcc564941132e17b28a7ceb2f3ebf0b9dae3e03fd7a6748eb0d"
+checksum = "8628dcc84e5a09eb3d8423d6cb682965dea9133204e8fb3efee74c2a0c259442"
 dependencies = [
  "bytes",
  "data-encoding",
- "http 1.2.0",
+ "http 1.3.1",
  "httparse",
  "log",
  "rand 0.9.2",
@@ -12899,9 +12924,9 @@ dependencies = [
 
 [[package]]
 name = "typenum"
-version = "1.15.0"
+version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dcf81ac59edc17cc8697ff311e8f5ef2d99fcbd9817b34cec66f90b6c3dfd987"
+checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
 
 [[package]]
 name = "tz-rs"
@@ -13603,8 +13628,7 @@ dependencies = [
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
  "aws-smithy-types",
- "axum",
- "axum-core",
+ "axum 0.8.6",
  "base16ct",
  "bindgen",
  "bit-set",
@@ -13623,6 +13647,7 @@ dependencies = [
  "concurrent-queue",
  "console",
  "criterion",
+ "crossbeam-channel",
  "crossbeam-deque",
  "crossbeam-epoch",
  "crossbeam-queue",
@@ -13649,12 +13674,12 @@ dependencies = [
  "getrandom 0.3.3",
  "half 2.6.0",
  "hashbrown 0.14.5",
- "hashbrown 0.15.3",
+ "hashbrown 0.15.4",
  "hyper 0.14.27",
  "hyper-util",
  "idna",
  "insta",
- "itertools 0.10.5",
+ "itertools 0.13.0",
  "libc",
  "libz-sys",
  "linux-raw-sys 0.4.15",
@@ -13740,7 +13765,7 @@ dependencies = [
  "tracing",
  "tracing-core",
  "tracing-subscriber",
- "tungstenite 0.24.0",
+ "tungstenite 0.28.0",
  "uncased",
  "unicode-bidi",
  "unicode-normalization",
diff --git a/deny.toml b/deny.toml
index 4d9005123a6da..33cfe004549ef 100644
--- a/deny.toml
+++ b/deny.toml
@@ -88,8 +88,8 @@ skip = [
 
     { name = "hyper-timeout", version = "0.4.1" },
 
-    { name = "tungstenite", version = "0.24.0" },
-    { name = "tokio-tungstenite", version = "0.24.0" },
+    { name = "tungstenite", version = "0.27.0" },
+    { name = "tokio-tungstenite", version = "0.27.0" },
 
     # `axum 0.7.5` depends on both `sync_wrapper 1.*` and `axum-core 0.4.3`.
     # The latter depends on `sync_wrapper 0.1.*`.
@@ -168,8 +168,11 @@ skip = [
     { name = "phf_shared", version = "0.11.3" },
     { name = "phf_generator", version = "0.11.2" },
     { name = "phf_codegen", version = "0.11.3" },
-    # multer
-    { name = "spin", version = "0.9.8" },
+    # axum
+    { name = "matchit", version = "0.7.0" },
+    # console-subscriber
+    { name = "axum", version = "0.7.9" },
+    { name = "axum-core", version = "0.4.5" },
 ]
 
 [[bans.deny]]
diff --git a/src/balancerd/Cargo.toml b/src/balancerd/Cargo.toml
index 075be8ad3cf30..6ff873133f214 100644
--- a/src/balancerd/Cargo.toml
+++ b/src/balancerd/Cargo.toml
@@ -12,7 +12,7 @@ workspace = true
 [dependencies]
 anyhow = "1.0.100"
 async-trait = "0.1.89"
-axum = "0.7.5"
+axum = "0.8.6"
 bytes = "1.10.1"
 bytesize = "2.1.0"
 chrono = { version = "0.4.39", default-features = false, features = ["std"] }
diff --git a/src/clusterd/Cargo.toml b/src/clusterd/Cargo.toml
index 96ca8cf53a0a4..305d5f89cdc30 100644
--- a/src/clusterd/Cargo.toml
+++ b/src/clusterd/Cargo.toml
@@ -11,7 +11,7 @@ workspace = true
 
 [dependencies]
 anyhow = "1.0.100"
-axum = "0.7.5"
+axum = "0.8.6"
 clap = { version = "4.5.23", features = ["derive", "env"] }
 fail = { version = "0.5.1", features = ["failpoints"] }
 futures = "0.3.31"
diff --git a/src/environmentd/Cargo.toml b/src/environmentd/Cargo.toml
index 8ba91dd45378d..aca9e4786d0e3 100644
--- a/src/environmentd/Cargo.toml
+++ b/src/environmentd/Cargo.toml
@@ -15,8 +15,8 @@ workspace = true
 anyhow = "1.0.100"
 askama = { version = "0.12.1", default-features = false, features = ["config", "serde-json"] }
 async-trait = "0.1.89"
-axum = { version = "0.7.5", features = ["ws"] }
-axum-extra = { version = "0.9.3", features = ["typed-header"] }
+axum = { version = "0.8.6", features = ["ws"] }
+axum-extra = { version = "0.10.3", features = ["typed-header"] }
 base64 = "0.22.1"
 bytes = "1.10.1"
 bytesize = "2.1.0"
@@ -124,7 +124,7 @@ tracing = "0.1.37"
 tracing-capture = { version = "0.1.0", optional = true }
 tracing-opentelemetry = { version = "0.25.0" }
 tracing-subscriber = "0.3.19"
-tungstenite = { version = "0.24.0" }
+tungstenite = { version = "0.28.0" }
 url = "2.3.1"
 uuid = "1.18.1"
 workspace-hack = { version = "0.0.0", path = "../workspace-hack", optional = true }
diff --git a/src/environmentd/src/http.rs b/src/environmentd/src/http.rs
index 02d4b3ed7b3c1..d2131507bac2d 100644
--- a/src/environmentd/src/http.rs
+++ b/src/environmentd/src/http.rs
@@ -25,7 +25,6 @@ use std::sync::Arc;
 use std::time::{Duration, SystemTime};
 
 use anyhow::Context;
-use async_trait::async_trait;
 use axum::error_handling::HandleErrorLayer;
 use axum::extract::ws::{Message, WebSocket};
 use axum::extract::{ConnectInfo, DefaultBodyLimit, FromRequestParts, Query, Request, State};
@@ -207,7 +206,7 @@ impl HttpServer {
                     "/hierarchical-memory",
                     routing::get(memory::handle_hierarchical_memory),
                 )
-                .route("/static/*path", routing::get(root::handle_static));
+                .route("/static/{*path}", routing::get(root::handle_static));
 
             let mut ws_router = Router::new()
                 .route("/api/experimental/sql", routing::get(sql::handle_sql_ws))
@@ -230,7 +229,7 @@ impl HttpServer {
         if routes_enabled.webhook {
             let webhook_router = Router::new()
                 .route(
-                    "/api/webhook/:database/:schema/:id",
+                    "/api/webhook/{:database}/{:schema}/{:id}",
                     routing::post(webhook::handle_webhook),
                 )
                 .with_state(WebhookState {
@@ -315,7 +314,7 @@ impl HttpServer {
                     routing::get(|| async { Redirect::temporary("/internal-console/") }),
                 )
                 .route(
-                    "/internal-console/*path",
+                    "/internal-console/{*path}",
                     routing::get(console::handle_internal_console),
                 )
                 .route(
@@ -606,7 +605,6 @@ impl AuthedClient {
     }
 }
 
-#[async_trait]
 impl<S> FromRequestParts<S> for AuthedClient
 where
     S: Send + Sync,
diff --git a/src/environmentd/src/http/sql.rs b/src/environmentd/src/http/sql.rs
index 764a579b0be68..2247ce9c9af4d 100644
--- a/src/environmentd/src/http/sql.rs
+++ b/src/environmentd/src/http/sql.rs
@@ -7,7 +7,6 @@
 // the Business Source License, use of this software will be governed
 // by the Apache License, Version 2.0.
 
-use std::borrow::Cow;
 use std::collections::BTreeMap;
 use std::net::{IpAddr, SocketAddr};
 use std::pin::pin;
@@ -354,7 +353,7 @@ async fn run_ws(state: &WsState, user: Option<AuthedUser>, peer_addr: IpAddr, mu
             // are safe to return because they're generated after authentication.
             debug!("WS request failed init: {}", e);
             let reason = match e.downcast_ref::<AdapterError>() {
-                Some(error) => Cow::Owned(error.to_string()),
+                Some(error) => error.to_string().into(),
                 None => "unauthorized".into(),
             };
             let _ = ws
@@ -385,7 +384,7 @@ async fn run_ws(state: &WsState, user: Option<AuthedUser>, peer_addr: IpAddr, mu
     ));
     for msg in msgs {
         let _ = ws
-            .send(Message::Text(
+            .send(Message::text(
                 serde_json::to_string(&msg).expect("must serialize"),
             ))
             .await;
@@ -491,7 +490,7 @@ async fn run_ws_request(
 /// Sends a single [`WebSocketResponse`] over the provided [`WebSocket`].
 async fn send_ws_response(ws: &mut WebSocket, resp: WebSocketResponse) -> Result<(), Error> {
     let msg = serde_json::to_string(&resp).unwrap();
-    let msg = Message::Text(msg);
+    let msg = Message::text(msg);
     ws.send(msg).await?;
 
     Ok(())
@@ -1104,7 +1103,7 @@ impl ResultSender for WebSocket {
             tick.tick().await;
             loop {
                 tick.tick().await;
-                if let Err(err) = self.send(Message::Ping(Vec::new())).await {
+                if let Err(err) = self.send(Message::Ping(Default::default())).await {
                     return err.into();
                 }
             }
diff --git a/src/environmentd/src/test_util.rs b/src/environmentd/src/test_util.rs
index d9a2fe26dd8e7..7c419e84a84be 100644
--- a/src/environmentd/src/test_util.rs
+++ b/src/environmentd/src/test_util.rs
@@ -1503,7 +1503,7 @@ pub fn auth_with_ws(
     }
     auth_with_ws_impl(
         ws,
-        Message::Text(
+        Message::text(
             serde_json::to_string(&WebSocketAuth::Basic {
                 user: "materialize".into(),
                 password: "".into(),
diff --git a/src/environmentd/tests/auth.rs b/src/environmentd/tests/auth.rs
index cb688ee8c4e18..e1faaa03635ed 100644
--- a/src/environmentd/tests/auth.rs
+++ b/src/environmentd/tests/auth.rs
@@ -355,11 +355,11 @@ async fn run_tests<'a>(header: &str, server: &test_util::TestServer, tests: &[Te
                 let stream = make_ws_tls(&uri, configure);
                 let (mut ws, _resp) = tungstenite::client(uri, stream).unwrap();
 
-                ws.send(Message::Text(serde_json::to_string(&auth).unwrap()))
+                ws.send(Message::text(serde_json::to_string(&auth).unwrap()))
                     .unwrap();
 
-                ws.send(Message::Text(
-                    r#"{"query": "SELECT pg_catalog.current_user()"}"#.into(),
+                ws.send(Message::text(
+                    r#"{"query": "SELECT pg_catalog.current_user()"}"#,
                 ))
                 .unwrap();
 
@@ -3482,7 +3482,7 @@ async fn test_password_auth_http() {
         .unwrap();
 
     let query = r#"{"query":"SELECT current_user"}"#;
-    let ws_options_msg = Message::Text(r#"{"options": {}}"#.to_owned());
+    let ws_options_msg = Message::text(r#"{"options": {}}"#);
 
     let http_client = hyper_util::client::legacy::Client::builder(TokioExecutor::new())
         .pool_idle_timeout(Duration::from_secs(10))
@@ -3511,7 +3511,7 @@ async fn test_password_auth_http() {
         ws.read().unwrap(),
         Message::Close(Some(CloseFrame {
             code: CloseCode::Protocol,
-            reason: Cow::Borrowed("unauthorized"),
+            reason: "unauthorized".into(),
         })),
     );
 
@@ -3577,7 +3577,7 @@ async fn test_password_auth_http() {
                 let msg: WebSocketResponse = serde_json::from_str(&msg).unwrap();
                 match msg {
                     WebSocketResponse::ReadyForQuery(_) => {
-                        ws.send(Message::Text(query.to_owned())).unwrap();
+                        ws.send(Message::text(query)).unwrap();
                     }
                     WebSocketResponse::Row(rows) => {
                         assert_eq!(&rows, &[serde_json::Value::from("mz_system".to_owned())]);
diff --git a/src/environmentd/tests/server.rs b/src/environmentd/tests/server.rs
index 7a5efafc41c1e..517e54bf058e3 100644
--- a/src/environmentd/tests/server.rs
+++ b/src/environmentd/tests/server.rs
@@ -914,8 +914,8 @@ fn test_http_sql() {
 
         f.run(|tc| {
             let msg = match tc.directive.as_str() {
-                "ws-text" => Message::Text(tc.input.clone()),
-                "ws-binary" => Message::Binary(tc.input.as_bytes().to_vec()),
+                "ws-text" => Message::text(&tc.input),
+                "ws-binary" => Message::Binary(tc.input.clone().into()),
                 "http" => {
                     let json: serde_json::Value = serde_json::from_str(&tc.input).unwrap();
                     let res = Client::new()
@@ -938,12 +938,12 @@ fn test_http_sql() {
             loop {
                 let resp = ws.read().unwrap();
                 match resp {
-                    Message::Text(mut msg) => {
-                        if fixtimestamp {
-                            msg = fixtimestamp_re
-                                .replace_all(&msg, fixtimestamp_replace)
-                                .into();
-                        }
+                    Message::Text(msg) => {
+                        let msg = if fixtimestamp {
+                            fixtimestamp_re.replace_all(&msg, fixtimestamp_replace)
+                        } else {
+                            msg.as_str().into()
+                        };
                         let msg: WebSocketResponse = serde_json::from_str(&msg).unwrap();
                         write!(&mut responses, "{}\n", serde_json::to_string(&msg).unwrap())
                             .unwrap();
@@ -1742,7 +1742,7 @@ fn test_max_request_size() {
         let json =
             format!("{{\"queries\":[{{\"query\":\"{statement}\",\"params\":[\"{param}\"]}}]}}");
         let json: serde_json::Value = serde_json::from_str(&json).unwrap();
-        ws.send(Message::Text(json.to_string())).unwrap();
+        ws.send(Message::text(json.to_string())).unwrap();
 
         // The specific error isn't forwarded to the client, the connection is just closed.
         let err = ws.read().unwrap_err();
@@ -1819,7 +1819,7 @@ fn test_max_statement_batch_size() {
         test_util::auth_with_ws(&mut ws, BTreeMap::default()).unwrap();
         let json = format!("{{\"query\":\"{statements}\"}}");
         let json: serde_json::Value = serde_json::from_str(&json).unwrap();
-        ws.send(Message::Text(json.to_string())).unwrap();
+        ws.send(Message::text(json.to_string())).unwrap();
 
         // Discard the CommandStarting message
         let _ = ws.read().unwrap();
@@ -1875,7 +1875,7 @@ fn test_ws_passes_options() {
     // set from the options map we passed with the auth.
     let json = "{\"query\":\"SHOW application_name;\"}";
     let json: serde_json::Value = serde_json::from_str(json).unwrap();
-    ws.send(Message::Text(json.to_string())).unwrap();
+    ws.send(Message::text(json.to_string())).unwrap();
 
     let mut read_msg = || -> WebSocketResponse {
         let msg = ws.read().unwrap();
@@ -1930,7 +1930,7 @@ fn test_ws_subscribe_no_crash() {
     let query = "SUBSCRIBE (SELECT 1)";
     let json = format!("{{\"query\":\"{query}\"}}");
     let json: serde_json::Value = serde_json::from_str(&json).unwrap();
-    ws.send(Message::Text(json.to_string())).unwrap();
+    ws.send(Message::text(json.to_string())).unwrap();
 
     // Give the server time to crash, if it's going to.
     std::thread::sleep(Duration::from_secs(1))
@@ -2143,7 +2143,7 @@ fn test_max_connections_on_all_interfaces() {
     test_util::auth_with_ws(&mut ws, BTreeMap::default()).unwrap();
     let json = format!("{{\"query\":\"{query}\"}}");
     let json: serde_json::Value = serde_json::from_str(&json).unwrap();
-    ws.send(Message::Text(json.to_string())).unwrap();
+    ws.send(Message::text(json.to_string())).unwrap();
 
     // The specific error isn't forwarded to the client, the connection is just closed.
     match ws.read() {
@@ -2154,13 +2154,13 @@ fn test_max_connections_on_all_interfaces() {
             );
             assert_eq!(
                 ws.read().unwrap(),
-                Message::Text(format!(
+                Message::text(format!(
                     r#"{{"type":"Rows","payload":{{"columns":[{{"name":"{UNKNOWN_COLUMN_NAME}","type_oid":23,"type_len":4,"type_mod":-1}}]}}}}"#
                 ))
             );
             assert_eq!(
                 ws.read().unwrap(),
-                Message::Text("{\"type\":\"Row\",\"payload\":[\"1\"]}".to_string())
+                Message::text("{\"type\":\"Row\",\"payload\":[\"1\"]}")
             );
             tracing::info!("data: {:?}", ws.read().unwrap());
         }
@@ -2593,7 +2593,7 @@ fn test_internal_ws_auth() {
     // Auth with OptionsOnly
     test_util::auth_with_ws_impl(
         &mut ws,
-        Message::Text(serde_json::to_string(&WebSocketAuth::OptionsOnly { options }).unwrap()),
+        Message::text(serde_json::to_string(&WebSocketAuth::OptionsOnly { options }).unwrap()),
     )
     .unwrap();
 
@@ -2601,7 +2601,7 @@ fn test_internal_ws_auth() {
     // set from the headers passed with the websocket request.
     let json = "{\"query\":\"SELECT current_user;\"}";
     let json: serde_json::Value = serde_json::from_str(json).unwrap();
-    ws.send(Message::Text(json.to_string())).unwrap();
+    ws.send(Message::text(json.to_string())).unwrap();
 
     let mut read_msg = || -> WebSocketResponse {
         let msg = ws.read().unwrap();
@@ -2768,7 +2768,7 @@ fn test_cancel_ws() {
     test_util::auth_with_ws(&mut ws, BTreeMap::default()).unwrap();
     let json = r#"{"queries":[{"query":"SUBSCRIBE t"}]}"#;
     let json: serde_json::Value = serde_json::from_str(json).unwrap();
-    ws.send(Message::Text(json.to_string())).unwrap();
+    ws.send(Message::text(json.to_string())).unwrap();
 
     loop {
         let msg = ws.read().unwrap();
@@ -2861,7 +2861,10 @@ async fn smoketest_webhook_source() {
     assert_eq!(total_requests_metric.get_counter().get_value(), 100.0);
 
     let path_label = &total_requests_metric.get_label()[0];
-    assert_eq!(path_label.value(), "/api/webhook/:database/:schema/:id");
+    assert_eq!(
+        path_label.value(),
+        "/api/webhook/{:database}/{:schema}/{:id}"
+    );
 
     let status_label = &total_requests_metric.get_label()[2];
     assert_eq!(status_label.value(), "200");
@@ -3057,10 +3060,10 @@ fn test_github_20262() {
 
     let (mut ws, _resp) = tungstenite::connect(server.ws_addr()).unwrap();
     test_util::auth_with_ws(&mut ws, BTreeMap::default()).unwrap();
-    ws.send(Message::Text(subscribe)).unwrap();
+    ws.send(Message::text(subscribe)).unwrap();
     cancel();
-    ws.send(Message::Text(commit)).unwrap();
-    ws.send(Message::Text(select)).unwrap();
+    ws.send(Message::text(commit)).unwrap();
+    ws.send(Message::text(select)).unwrap();
 
     let mut expect = VecDeque::from([
         r#"{"type":"CommandStarting","payload":{"has_rows":true,"is_streaming":true}}"#.to_string(),
@@ -4353,7 +4356,7 @@ async fn test_double_encoded_json() {
 
     let json = "{\"query\":\"SELECT a FROM t1 ORDER BY a;\"}";
     let json: serde_json::Value = serde_json::from_str(json).unwrap();
-    ws.send(Message::Text(json.to_string())).unwrap();
+    ws.send(Message::text(json.to_string())).unwrap();
 
     let mut read_msg = || -> WebSocketResponse {
         let msg = ws.read().unwrap();
diff --git a/src/environmentd/tests/sql.rs b/src/environmentd/tests/sql.rs
index b59b0b7b5b388..32b0fa9e1cc6b 100644
--- a/src/environmentd/tests/sql.rs
+++ b/src/environmentd/tests/sql.rs
@@ -65,7 +65,7 @@ impl MockHttpServer {
     async fn new() -> MockHttpServer {
         let (conn_tx, conn_rx) = mpsc::unbounded_channel();
         let router = Router::new().route(
-            "/*path",
+            "/{*path}",
             routing::get(|| async move {
                 let (response_tx, response_rx) = oneshot::channel();
                 conn_tx
diff --git a/src/frontegg-auth/Cargo.toml b/src/frontegg-auth/Cargo.toml
index 85098530d72f9..5abaefb71cbf3 100644
--- a/src/frontegg-auth/Cargo.toml
+++ b/src/frontegg-auth/Cargo.toml
@@ -32,7 +32,7 @@ uuid = { version = "1.18.1", features = ["serde"] }
 workspace-hack = { version = "0.0.0", path = "../workspace-hack", optional = true }
 
 [dev-dependencies]
-axum = "0.7.5"
+axum = "0.8.6"
 mz-ore = { path = "../ore", features = ["network", "test"] }
 tokio = { version = "1.44.1", features = ["macros", "rt-multi-thread"] }
 
diff --git a/src/frontegg-auth/src/client/tokens.rs b/src/frontegg-auth/src/client/tokens.rs
index ebc464c7de9ac..95aaf8119813e 100644
--- a/src/frontegg-auth/src/client/tokens.rs
+++ b/src/frontegg-auth/src/client/tokens.rs
@@ -117,7 +117,7 @@ mod tests {
 
         // Fake server that returns the provided status code a few times before returning success.
         let app = Router::new().route(
-            "/:status_code",
+            "/{:status_code}",
             post(
                 |axum::extract::Path(code): axum::extract::Path<u16>| async move {
                     let cnt = count_.fetch_add(1, Ordering::Relaxed);
diff --git a/src/frontegg-mock/Cargo.toml b/src/frontegg-mock/Cargo.toml
index 9f7da7ba29dc6..eace1e1112873 100644
--- a/src/frontegg-mock/Cargo.toml
+++ b/src/frontegg-mock/Cargo.toml
@@ -11,8 +11,8 @@ workspace = true
 
 [dependencies]
 anyhow = "1.0.100"
-axum = "0.7.5"
-axum-extra = { version = "0.9.3", features = ["typed-header"] }
+axum = "0.8.6"
+axum-extra = { version = "0.10.3", features = ["typed-header"] }
 base64 = "0.22.1"
 chrono = { version = "0.4.39", default-features = false, features = ["serde"] }
 clap = { version = "4.5.23", features = ["derive", "env"] }
diff --git a/src/frontegg-mock/src/server.rs b/src/frontegg-mock/src/server.rs
index 65c620d1d6b90..d8213e18ef3e6 100644
--- a/src/frontegg-mock/src/server.rs
+++ b/src/frontegg-mock/src/server.rs
@@ -32,31 +32,32 @@ const AUTH_API_TOKEN_PATH: &str = "/identity/resources/auth/v1/api-token";
 const AUTH_USER_PATH: &str = "/identity/resources/auth/v1/user";
 const AUTH_API_TOKEN_REFRESH_PATH: &str = "/identity/resources/auth/v1/api-token/token/refresh";
 const GROUPS_PATH: &str = "/frontegg/identity/resources/groups/v1";
-const GROUP_PATH: &str = "/frontegg/identity/resources/groups/v1/:id";
-const GROUP_ROLES_PATH: &str = "/frontegg/identity/resources/groups/v1/:id/roles";
-const GROUP_USERS_PATH: &str = "/frontegg/identity/resources/groups/v1/:id/users";
-const GROUP_PATH_WITH_SLASH: &str = "/frontegg/identity/resources/groups/v1/:id/";
+const GROUP_PATH: &str = "/frontegg/identity/resources/groups/v1/{:id}";
+const GROUP_ROLES_PATH: &str = "/frontegg/identity/resources/groups/v1/{:id}/roles";
+const GROUP_USERS_PATH: &str = "/frontegg/identity/resources/groups/v1/{:id}/users";
+const GROUP_PATH_WITH_SLASH: &str = "/frontegg/identity/resources/groups/v1/{:id}/";
 const MEMBERS_PATH: &str = "/frontegg/team/resources/members/v1";
 const USERS_ME_PATH: &str = "/identity/resources/users/v2/me";
 const USERS_API_TOKENS_PATH: &str = "/identity/resources/users/api-tokens/v1";
-const USER_API_TOKENS_PATH: &str = "/identity/resources/users/api-tokens/v1/:id";
+const USER_API_TOKENS_PATH: &str = "/identity/resources/users/api-tokens/v1/{:id}";
 const TENANT_API_TOKENS_PATH: &str = "/identity/resources/tenants/api-tokens/v1";
-const TENANT_API_TOKEN_PATH: &str = "/identity/resources/tenants/api-tokens/v1/:id";
-const USER_PATH: &str = "/identity/resources/users/v1/:id";
+const TENANT_API_TOKEN_PATH: &str = "/identity/resources/tenants/api-tokens/v1/{:id}";
+const USER_PATH: &str = "/identity/resources/users/v1/{:id}";
 const USER_CREATE_PATH: &str = "/identity/resources/users/v2";
 const USERS_V3_PATH: &str = "/identity/resources/users/v3";
 const ROLES_PATH: &str = "/identity/resources/roles/v2";
 const SCIM_CONFIGURATIONS_PATH: &str = "/frontegg/directory/resources/v1/configurations/scim2";
-const SCIM_CONFIGURATION_PATH: &str = "/frontegg/directory/resources/v1/configurations/scim2/:id";
+const SCIM_CONFIGURATION_PATH: &str = "/frontegg/directory/resources/v1/configurations/scim2/{:id}";
 const SSO_CONFIGS_PATH: &str = "/frontegg/team/resources/sso/v1/configurations";
-const SSO_CONFIG_PATH: &str = "/frontegg/team/resources/sso/v1/configurations/:id";
-const SSO_CONFIG_DOMAINS_PATH: &str = "/frontegg/team/resources/sso/v1/configurations/:id/domains";
+const SSO_CONFIG_PATH: &str = "/frontegg/team/resources/sso/v1/configurations/{:id}";
+const SSO_CONFIG_DOMAINS_PATH: &str =
+    "/frontegg/team/resources/sso/v1/configurations/{:id}/domains";
 const SSO_CONFIG_DOMAIN_PATH: &str =
-    "/frontegg/team/resources/sso/v1/configurations/:id/domains/:domain_id";
-const SSO_CONFIG_GROUPS_PATH: &str = "/frontegg/team/resources/sso/v1/configurations/:id/groups";
+    "/frontegg/team/resources/sso/v1/configurations/{:id}/domains/{:domain_id}";
+const SSO_CONFIG_GROUPS_PATH: &str = "/frontegg/team/resources/sso/v1/configurations/{:id}/groups";
 const SSO_CONFIG_GROUP_PATH: &str =
-    "/frontegg/team/resources/sso/v1/configurations/:id/groups/:group_id";
-const SSO_CONFIG_ROLES_PATH: &str = "/frontegg/team/resources/sso/v1/configurations/:id/roles";
+    "/frontegg/team/resources/sso/v1/configurations/{:id}/groups/{:group_id}";
+const SSO_CONFIG_ROLES_PATH: &str = "/frontegg/team/resources/sso/v1/configurations/{:id}/roles";
 
 // Internal endpoints for testing
 const INTERNAL_USER_PASSWORD_PATH: &str = "/api/internal-mock/user-password";
diff --git a/src/http-util/Cargo.toml b/src/http-util/Cargo.toml
index 8e54ee75d5529..e081203cf747e 100644
--- a/src/http-util/Cargo.toml
+++ b/src/http-util/Cargo.toml
@@ -12,8 +12,8 @@ workspace = true
 [dependencies]
 anyhow = "1.0.100"
 askama = { version = "0.12.1", default-features = false, features = ["config", "serde-json"] }
-axum = "0.7.5"
-axum-extra = { version = "0.9.3", features = ["typed-header"] }
+axum = "0.8.6"
+axum-extra = { version = "0.10.3", features = ["typed-header"] }
 headers = "0.4.1"
 http = "1.2.0"
 hyper = { version = "1.4.1", features = ["http1", "server"] }
diff --git a/src/metabase/src/lib.rs b/src/metabase/src/lib.rs
index 88da0fddbb0a4..84fbcfbb8b7c7 100644
--- a/src/metabase/src/lib.rs
+++ b/src/metabase/src/lib.rs
@@ -109,7 +109,7 @@ impl Client {
 
     /// Fetches metadata about a particular database.
     ///
-    /// The underlying API call is `GET /database/:id/metadata`.
+    /// The underlying API call is `GET /database/{:id}/metadata`.
     pub async fn database_metadata(&self, id: usize) -> Result<DatabaseMetadata, reqwest::Error> {
         let url = self.api_url(&["database", &id.to_string(), "metadata"]);
         self.send_request(self.inner.get(url)).await
diff --git a/src/mz/Cargo.toml b/src/mz/Cargo.toml
index fb532959d291a..46b83d807a24a 100644
--- a/src/mz/Cargo.toml
+++ b/src/mz/Cargo.toml
@@ -10,7 +10,7 @@ rust-version.workspace = true
 workspace = true
 
 [dependencies]
-axum = "0.7.5"
+axum = "0.8.6"
 clap = { version = "4.5.23", features = [ "derive" ] }
 csv = "1.3.1"
 dirs = "6.0.0"
diff --git a/src/orchestratord/Cargo.toml b/src/orchestratord/Cargo.toml
index 4ed7c67cd080f..5c9538271cf3e 100644
--- a/src/orchestratord/Cargo.toml
+++ b/src/orchestratord/Cargo.toml
@@ -12,7 +12,7 @@ workspace = true
 [dependencies]
 anyhow = "1.0.100"
 async-trait = "0.1.89"
-axum = "0.7.5"
+axum = "0.8.6"
 chrono = { version = "0.4.39", default-features = false }
 clap = { version = "4.5.23", features = ["derive"] }
 futures = "0.3.31"
diff --git a/src/ore/Cargo.toml b/src/ore/Cargo.toml
index 7ffc934cc4c9d..178f653b4191f 100644
--- a/src/ore/Cargo.toml
+++ b/src/ore/Cargo.toml
@@ -107,7 +107,7 @@ tokio-test = "0.4.4"
 tracing-subscriber = "0.3.19"
 
 [features]
-default = ["tokio-console", "workspace-hack", "mz-ore-proc/workspace-hack"]
+default = ["workspace-hack", "mz-ore-proc/workspace-hack"]
 async = [
     "async-trait",
     "futures",
diff --git a/src/persist-cli/Cargo.toml b/src/persist-cli/Cargo.toml
index 40e883078af46..8ddcd376364a1 100644
--- a/src/persist-cli/Cargo.toml
+++ b/src/persist-cli/Cargo.toml
@@ -20,7 +20,7 @@ bench = false
 anyhow = "1.0.100"
 arrow = { version = "55.2.0", default-features = false }
 async-trait = "0.1.89"
-axum = "0.7.5"
+axum = "0.8.6"
 bytes = { version = "1.10.1", features = ["serde"] }
 clap = { version = "4.5.23", features = ["derive", "env"] }
 differential-dataflow = "0.17.0"
diff --git a/src/prof-http/Cargo.toml b/src/prof-http/Cargo.toml
index 04f7a5f6fc2d3..0554a6c78394a 100644
--- a/src/prof-http/Cargo.toml
+++ b/src/prof-http/Cargo.toml
@@ -11,8 +11,8 @@ workspace = true
 
 [dependencies]
 askama = { version = "0.12.1", default-features = false, features = ["config", "serde-json"] }
-axum = "0.7.5"
-axum-extra = { version = "0.9.3", features = ["typed-header"] }
+axum = "0.8.6"
+axum-extra = { version = "0.10.3", features = ["typed-header"] }
 bytesize = "2.1.0"
 cfg-if = "1.0.4"
 headers = "0.4.1"
diff --git a/src/prof-http/src/lib.rs b/src/prof-http/src/lib.rs
index b3eae5f157b65..1034a237b804e 100644
--- a/src/prof-http/src/lib.rs
+++ b/src/prof-http/src/lib.rs
@@ -60,7 +60,7 @@ pub fn router(build_info: &'static BuildInfo) -> Router {
             routing::post(move |form| handle_post(form, build_info)),
         )
         .route("/heap", routing::get(handle_get_heap))
-        .route("/static/*path", routing::get(handle_static))
+        .route("/static/{*path}", routing::get(handle_static))
 }
 
 #[allow(dead_code)]
diff --git a/src/storage/Cargo.toml b/src/storage/Cargo.toml
index ebdd4aba24f8f..5125286857fa8 100644
--- a/src/storage/Cargo.toml
+++ b/src/storage/Cargo.toml
@@ -90,7 +90,7 @@ workspace-hack = { version = "0.0.0", path = "../workspace-hack", optional = tru
 
 [dev-dependencies]
 async-trait = "0.1.89"
-axum = "0.7.5"
+axum = "0.8.6"
 clap = { version = "4.5.23", features = ["derive", "env"] }
 humantime = "2.2.0"
 mz-http-util = { path = "../http-util" }
diff --git a/src/workspace-hack/Cargo.toml b/src/workspace-hack/Cargo.toml
index 46850c35c7306..64a36b2bc4da5 100644
--- a/src/workspace-hack/Cargo.toml
+++ b/src/workspace-hack/Cargo.toml
@@ -31,8 +31,7 @@ aws-smithy-http = { version = "0.60.12", default-features = false, features = ["
 aws-smithy-runtime = { version = "1.9.3", default-features = false, features = ["client", "connector-hyper-0-14-x"] }
 aws-smithy-runtime-api = { version = "1.9.1", features = ["client", "http-02x", "http-auth", "test-util"] }
 aws-smithy-types = { version = "1.3.3", default-features = false, features = ["byte-stream-poll-next", "http-body-0-4-x", "http-body-1-x", "rt-tokio", "test-util"] }
-axum = { version = "0.7.9", features = ["ws"] }
-axum-core = { version = "0.4.5", default-features = false, features = ["tracing"] }
+axum = { version = "0.8.6", features = ["ws"] }
 base16ct = { version = "0.2.0", default-features = false, features = ["alloc"] }
 bit-set = { version = "0.8.0" }
 bit-vec = { version = "0.8.0" }
@@ -47,6 +46,7 @@ clap_builder = { version = "4.5.23", default-features = false, features = ["colo
 concurrent-queue = { version = "2.5.0" }
 console = { version = "0.15.11", default-features = false, features = ["ansi-parsing", "unicode-width"] }
 criterion = { version = "0.6.0", features = ["async_tokio", "html_reports"] }
+crossbeam-channel = { version = "0.5.15" }
 crossbeam-deque = { version = "0.8.6" }
 crossbeam-epoch = { version = "0.9.18" }
 crossbeam-queue = { version = "0.3.12" }
@@ -72,12 +72,12 @@ futures-util = { version = "0.3.31", features = ["channel", "io", "sink"] }
 getrandom-468e82937335b1c9 = { package = "getrandom", version = "0.3.3", default-features = false, features = ["std", "wasm_js"] }
 getrandom-6f8ce4dd05d13bba = { package = "getrandom", version = "0.2.16", default-features = false, features = ["std"] }
 half = { version = "2.6.0", features = ["num-traits"] }
-hashbrown-3575ec1268b04181 = { package = "hashbrown", version = "0.15.3" }
+hashbrown-3575ec1268b04181 = { package = "hashbrown", version = "0.15.4" }
 hashbrown-582f2526e08bb6a0 = { package = "hashbrown", version = "0.14.5", default-features = false, features = ["allocator-api2", "inline-more", "raw"] }
 hyper = { version = "0.14.27", features = ["client", "http1", "http2", "stream", "tcp"] }
 hyper-util = { version = "0.1.17", features = ["client-legacy", "server-auto", "service", "tracing"] }
 insta = { version = "1.43.2", features = ["json"] }
-itertools = { version = "0.10.5" }
+itertools = { version = "0.13.0" }
 libc = { version = "0.2.177", features = ["extra_traits", "use_std"] }
 libz-sys = { version = "1.1.22", features = ["static"] }
 lock_api = { version = "0.4.14", features = ["serde"] }
@@ -150,7 +150,7 @@ tower-http = { version = "0.6.6", features = ["auth", "cors", "decompression-br"
 tracing = { version = "0.1.41", features = ["log"] }
 tracing-core = { version = "0.1.34" }
 tracing-subscriber = { version = "0.3.20", features = ["env-filter", "json"] }
-tungstenite = { version = "0.24.0" }
+tungstenite = { version = "0.28.0" }
 uncased = { version = "0.9.10" }
 unicode-bidi = { version = "0.3.18" }
 unicode-normalization = { version = "0.1.24" }
@@ -177,8 +177,7 @@ aws-smithy-http = { version = "0.60.12", default-features = false, features = ["
 aws-smithy-runtime = { version = "1.9.3", default-features = false, features = ["client", "connector-hyper-0-14-x"] }
 aws-smithy-runtime-api = { version = "1.9.1", features = ["client", "http-02x", "http-auth", "test-util"] }
 aws-smithy-types = { version = "1.3.3", default-features = false, features = ["byte-stream-poll-next", "http-body-0-4-x", "http-body-1-x", "rt-tokio", "test-util"] }
-axum = { version = "0.7.9", features = ["ws"] }
-axum-core = { version = "0.4.5", default-features = false, features = ["tracing"] }
+axum = { version = "0.8.6", features = ["ws"] }
 base16ct = { version = "0.2.0", default-features = false, features = ["alloc"] }
 bindgen = { version = "0.72.1", default-features = false, features = ["runtime"] }
 bit-set = { version = "0.8.0" }
@@ -196,6 +195,7 @@ clap_builder = { version = "4.5.23", default-features = false, features = ["colo
 concurrent-queue = { version = "2.5.0" }
 console = { version = "0.15.11", default-features = false, features = ["ansi-parsing", "unicode-width"] }
 criterion = { version = "0.6.0", features = ["async_tokio", "html_reports"] }
+crossbeam-channel = { version = "0.5.15" }
 crossbeam-deque = { version = "0.8.6" }
 crossbeam-epoch = { version = "0.9.18" }
 crossbeam-queue = { version = "0.3.12" }
@@ -221,12 +221,12 @@ futures-util = { version = "0.3.31", features = ["channel", "io", "sink"] }
 getrandom-468e82937335b1c9 = { package = "getrandom", version = "0.3.3", default-features = false, features = ["std", "wasm_js"] }
 getrandom-6f8ce4dd05d13bba = { package = "getrandom", version = "0.2.16", default-features = false, features = ["std"] }
 half = { version = "2.6.0", features = ["num-traits"] }
-hashbrown-3575ec1268b04181 = { package = "hashbrown", version = "0.15.3" }
+hashbrown-3575ec1268b04181 = { package = "hashbrown", version = "0.15.4" }
 hashbrown-582f2526e08bb6a0 = { package = "hashbrown", version = "0.14.5", default-features = false, features = ["allocator-api2", "inline-more", "raw"] }
 hyper = { version = "0.14.27", features = ["client", "http1", "http2", "stream", "tcp"] }
 hyper-util = { version = "0.1.17", features = ["client-legacy", "server-auto", "service", "tracing"] }
 insta = { version = "1.43.2", features = ["json"] }
-itertools = { version = "0.10.5" }
+itertools = { version = "0.13.0" }
 libc = { version = "0.2.177", features = ["extra_traits", "use_std"] }
 libz-sys = { version = "1.1.22", features = ["static"] }
 lock_api = { version = "0.4.14", features = ["serde"] }
@@ -302,7 +302,7 @@ tower-http = { version = "0.6.6", features = ["auth", "cors", "decompression-br"
 tracing = { version = "0.1.41", features = ["log"] }
 tracing-core = { version = "0.1.34" }
 tracing-subscriber = { version = "0.3.20", features = ["env-filter", "json"] }
-tungstenite = { version = "0.24.0" }
+tungstenite = { version = "0.28.0" }
 uncased = { version = "0.9.10" }
 unicode-bidi = { version = "0.3.18" }
 unicode-normalization = { version = "0.1.24" }